Skip to content
CKSSupply Chain SecuritySingle nodeEasy

Static analysis of workload manifests

Scenario cks-sup-002 · about 8 minutes · 7 points · 4 grader checks

Review six Deployment manifests against four security rules, report the violators and deploy only the compliant ones.

  • static-analysis
  • manifests
  • supply-chain
  • securitycontext
  • review

What you will practise

  • Read manifests for privileged, root, hostPath and mutable-tag risks
  • Gate deployment on a static review
  • Apply a selected subset of manifests

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-sup-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Before deployment, workload manifests must pass a static review. The directory /opt/scan/manifests on exam-cp1 holds six Deployment manifests for namespace "scan". The team rules are: R1 every container image has an explicit tag that is not "latest" (or is pinned by digest); R2 no container runs privileged; R3 every container runs as non-root (runAsNonRoot: true at pod or container level); R4 no hostPath volumes. 1. Write the names of the manifests that break at least one rule to /opt/scan/violations.txt on exam-cp1, one file name without the ".yaml" suffix per line. 2. Apply only the compliant manifests, unchanged. Their Deployments must be Ready; none of the violating Deployments may exist in "scan".

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Supply Chain Security
Difficulty
Easy
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
7
Grader checks
4
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 4 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Supply Chain Security labs

CKSSupply Chain SecurityHard

Permitted registries with ValidatingAdmissionPolicy

Allow only images from one registry in labelled namespaces using a CEL ValidatingAdmissionPolicy and its binding.

Single node · ~9 min · 9 points

  • validatingadmissionpolicy
  • cel
  • admission
  • image-registry
  • supply-chain

goldenkube start cks-sup-001

CKSSupply Chain SecurityEasy

Pin a workload image by digest

Replace a mutable image tag with the digest of the image the running pods already use.

Single node · ~6 min · 7 points

  • image-digest
  • supply-chain
  • immutability
  • deployment
  • containerd

goldenkube start cks-sup-003

CKSSupply Chain SecurityEasy

Verify platform binaries before deploying

Check downloaded Kubernetes binaries against published SHA-512 checksums and discard the tampered ones.

Single node · ~6 min · 6 points

  • checksums
  • sha512
  • binaries
  • supply-chain
  • upgrade

goldenkube start cks-sup-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.